The vulnerability CVE-2026-22417 affects ThemeGoods Grand Wedding versions before 3.1.11 and involves deserialization of untrusted data, which enables object injection attacks. This type of vulnerability can allow an attacker to manipulate serialized objects to execute arbitrary code or cause other malicious effects. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code, compromise data confidentiality and integrity, and disrupt service availability in affected installations of ThemeGoods Grand Wedding prior to version 3.1.11. The critical CVSS score indicates severe potential impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeGoods communications for updates. Until a fix is available, consider restricting access to the affected application to trusted users and environments to reduce exposure.